Analysis
-
max time kernel
141s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
19/07/2024, 23:06
General
-
Target
Creed All Spoofer/Creed.exe
-
Size
22.8MB
-
MD5
0ede063d189d5176683244c62cb160a7
-
SHA1
9a1aedd08f3bb29390cce31a5d16eaa8681c6089
-
SHA256
499ec15d37c4816953ea43ef49043143341cde6b95ba447d1791c40f80f6b5b9
-
SHA512
acb404002ac791e906f32ad4290984edafee899748ac0b924a838d20107b9e7c3b64631b7ea83e3592d174e6a92434922aa6a1832a7fb9cb5d8ac8f762609bb0
-
SSDEEP
393216:r67Ft/tiAuJOzzZRFMCcCLVzSordVGGtdmaD3U38UfXkOuthQnjs84GFmQClq23m:r67Ft/tiAuJOzzZRFMCcCLVzSordVGGs
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 1 IoCs
-
Themida packer 8 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Creed All Spoofer\Creed.exe"C:\Users\Admin\AppData\Local\Temp\Creed All Spoofer\Creed.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"success":false,"message":"Session not found. Use latest code. You can only have app opened 1 at a time."} && timeout /t 5"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Response: {"success":false,"message":"Session not found. Use latest code. You can only have app opened 1 at a time."} && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD505b012457488a95a05d0541e0470d392
SHA174f541d6a8365508c794ef7b4ac7c297457f9ce3
SHA2561f77a0749ac730500f203b8c4d072587923ac679e184a3859aeb855c2a2e7d8d
SHA5126d6e7b838d4425d49ac8d3738135374ef5357f0677b07cecb7afbf5feddc1997bf6dce68d48787eff8a74c4728def8880c8f01842eda35b5815fb561fa401ae6
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
11.5MB
-
Filesize
2.9MB
-
Filesize
1.3MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
592KB
-
Filesize
1.3MB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
22.8MB
-
Filesize
24KB
-
Filesize
11.5MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
11.5MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
11.5MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
10.8MB